Data forgery detection method and device, electronic equipment and storage medium

Abstract

The invention belongs to the technical field of data detection and identification, and discloses a data forgery detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining to-be-detected data; extracting data features of the to-be-detected data; comparing the time sequence feature with a time sequence of to-be-detected data in the time sequences of the multiple pieces of data to obtain a first comparison result; comparing the content characteristics with index contents of the to-be-detected data and / or session contents in a session file corresponding to the to-be-detected data to obtain a second comparison result; inputting the grammatical features into a pre-trained grammatical feature classification model to obtain feature types to which the grammatical features belong; and determining the to-be-detected data as forged data under the condition that the forged data condition is met. Therefore, by combining the extracted multi-dimensional data features with the grammatical feature classification model, the data can be efficiently and accurately subjected to forgery detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of data detection and identification, and in particular relates to a data forgery detection method, device, electronic equipment and storage medium. Background Art

[0002] With the rapid development of network communication technology, data interaction has become increasingly frequent and important. However, in the process of data interaction, data may be forged or tampered with, which poses a serious threat to data security. Therefore, developing an efficient data forgery detection technology is of great significance for protecting data security and maintaining network order.

[0003] The technical solutions in the related technologies are still limited to the collection and fixation of data. Currently, there is no method that can detect and identify the authenticity of data. Therefore, there is an urgent need to provide an efficient and accurate data forgery detection method. Summary of the invention

[0004] The purpose of the present invention is to efficiently and accurately detect data forgery.

[0005] In a first aspect, an embodiment of the present invention provides a data forgery detection method, the method comprising:

[0006] Obtain the data to be tested;

[0007] Extracting data features of the data to be detected; the data features include time series features, content features and grammatical features of the data to be detected;

[0008] Comparing the time series feature with the time series of the data to be detected in the time series of the plurality of data to obtain a first comparison result; and comparing the content feature with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result; the plurality of data include the data to be detected, and the first comparison result and the second comparison result both include: comparison consistency and comparison inconsistency;

[0009] Inputting the grammatical feature into a pre-trained grammatical feature classification model to obtain a feature type to which the grammatical feature belongs; the feature type includes an untampered feature type and a tampered feature type;

[0010] When a forged data condition is met, the data to be detected is determined to be forged data; the forged data condition includes one or more of the following conditions: the first comparison result is a comparison inconsistency, the second comparison result is a comparison inconsistency, and the feature type is a tampered feature type.

[0011] Optionally, when the data forgery condition is not met, the method further includes:

[0012] Inputting the data to be detected into a pre-trained forged data recognition model; the forged data recognition model is trained by real data samples and forged data samples;

[0013] The data to be detected is identified by the forged data identification model to obtain the forgery type of the data to be detected, where the forgery type includes whether the data to be detected is forged data or whether the data to be detected is not forged data.

[0014] Optionally, the forged data identification model includes a plurality of forged data identification sub-models;

[0015] The step of identifying the data to be detected by using the forged data identification model to obtain the forgery type of the data to be detected includes:

[0016] The data to be detected are respectively identified by the multiple forged data identification sub-models to obtain multiple forged types of the data to be detected, and when a target forged type exists among the multiple forged types, the data to be detected is determined to be forged data; each of the forged data identification sub-models outputs a forged type; the target forged type is that the data to be detected is forged data;

[0017] or,

[0018] The data to be detected are respectively identified by the multiple forged data identification sub-models to obtain multiple forgery types of the data to be detected, and when the proportion of target forgery types in the multiple forgery types is greater than the proportion of non-target forgery types, it is determined that the data to be detected is forged data; the non-target forgery type means that the data to be detected is not forged data.

[0019] Optionally, comparing the time series feature with the time series of the data to be detected in the time series of the plurality of data to obtain a first comparison result includes:

[0020] Acquire a time series of a plurality of data including the data to be detected; and search for a time series corresponding to the data to be detected in the time series of the plurality of data;

[0021] Comparing the time series characteristics of the data to be detected with the time series corresponding to the found data to be detected;

[0022] When the time series feature of the to-be-detected data is consistent with the event sequence corresponding to the found to-be-detected data, determining the first comparison result as comparison consistency;

[0023] When the time series feature of the to-be-detected data is inconsistent with the event sequence corresponding to the found to-be-detected data, it is determined that the first comparison result is a comparison inconsistency.

[0024] Optionally, the comparing the content feature with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result includes:

[0025] Obtaining a temporary session file corresponding to the data to be detected;

[0026] Parsing the temporary session file to obtain the session content included in the temporary session file;

[0027] Comparing the content characteristics of the data to be detected with the conversation content;

[0028] When the content feature of the data to be detected is consistent with the conversation content, determining the second comparison result as comparison consistency;

[0029] When the content feature of the data to be detected is inconsistent with the conversation content, the second comparison result is determined to be a comparison inconsistency.

[0030] Optionally, the comparing the content feature with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result includes:

[0031] Searching for index content corresponding to the data to be detected in a target data index table; the target data index table stores index content corresponding to the data to be detected;

[0032] Comparing the content characteristics with the found index content;

[0033] When the content feature of the data to be detected is consistent with the searched index content, determining the second comparison result as comparison consistency;

[0034] When the content feature of the to-be-detected data is inconsistent with the found index content, the second comparison result is determined to be inconsistent.

[0035] In a second aspect, the present invention provides a data forgery detection device, the device comprising:

[0036] A data acquisition module, used for acquiring data to be detected;

[0037] A feature extraction module, used to extract data features of the data to be detected; the data features include time series features, content features and grammatical features of the data to be detected;

[0038] The feature comparison module is used to compare the time series feature with the time series of the data to be detected in the time series of the multiple data to obtain a first comparison result; and compare the content feature with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result; the multiple data include the data to be detected, and the first comparison result and the second comparison result both include: comparison consistency and comparison inconsistency;

[0039] A feature classification module, used for inputting the grammatical feature into a pre-trained grammatical feature classification model to obtain a feature type to which the grammatical feature belongs; the feature type includes an untampered feature type and a tampered feature type;

[0040] A data detection module is used to determine that the data to be detected is forged data when a forged data condition is met; the forged data condition includes one or more of the following conditions: the first comparison result is a comparison inconsistency, the second comparison result is a comparison inconsistency, and the feature type is a tampered feature type.

[0041] Optionally, the device further comprises a forged data identification module, which is used to:

[0042] In the case where the forged data condition is not met, the data to be detected is input into a forged data recognition model obtained by pre-training; the forged data recognition model is obtained by training real data samples and forged data samples;

[0043] The data to be detected is identified by the forged data identification model to obtain the forgery type of the data to be detected, where the forgery type includes whether the data to be detected is forged data or whether the data to be detected is not forged data.

[0044] Optionally, the forged data identification model includes a plurality of forged data identification sub-models;

[0045] The forged data identification module is specifically used for:

[0046] The data to be detected are respectively identified by the multiple forged data identification sub-models to obtain multiple forged types of the data to be detected, and when a target forged type exists among the multiple forged types, the data to be detected is determined to be forged data; each of the forged data identification sub-models outputs a forged type; the target forged type is that the data to be detected is forged data;

[0047] or,

[0048] The data to be detected are respectively identified by the multiple forged data identification sub-models to obtain multiple forgery types of the data to be detected, and when the proportion of target forgery types in the multiple forgery types is greater than the proportion of non-target forgery types, it is determined that the data to be detected is forged data; the non-target forgery type means that the data to be detected is not forged data.

[0049] Optionally, the feature comparison module is specifically used to:

[0050] Acquire a time series of a plurality of data including the data to be detected; and search for a time series corresponding to the data to be detected in the time series of the plurality of data;

[0051] Comparing the time series characteristics of the data to be detected with the time series corresponding to the found data to be detected;

[0052] When the time series feature of the to-be-detected data is consistent with the event sequence corresponding to the found to-be-detected data, determining the first comparison result as comparison consistency;

[0053] When the time series feature of the to-be-detected data is inconsistent with the event sequence corresponding to the found to-be-detected data, it is determined that the first comparison result is a comparison inconsistency.

[0054] Optionally, the feature comparison module is specifically used to:

[0055] Obtaining a temporary session file corresponding to the data to be detected;

[0056] Parsing the temporary session file to obtain the session content included in the temporary session file;

[0057] Comparing the content characteristics of the data to be detected with the conversation content;

[0058] When the content feature of the data to be detected is consistent with the conversation content, determining the second comparison result as comparison consistency;

[0059] When the content feature of the data to be detected is inconsistent with the conversation content, the second comparison result is determined to be a comparison inconsistency.

[0060] Optionally, the feature comparison module is specifically used to:

[0061] Searching for index content corresponding to the data to be detected in a target data index table; the target data index table stores index content corresponding to the data to be detected;

[0062] Comparing the content characteristics with the found index content;

[0063] When the content feature of the data to be detected is consistent with the searched index content, determining the second comparison result as comparison consistency;

[0064] When the content feature of the to-be-detected data is inconsistent with the found index content, the second comparison result is determined to be inconsistent.

[0065] In a third aspect, an embodiment of the present invention further provides an electronic device, including:

[0066] at least one processor;

[0067] a memory for storing the at least one processor-executable instruction;

[0068] The at least one processor is configured to execute the instructions to implement the forged data detection method.

[0069] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to execute the forged data detection method described above.

[0070] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program, which implements the forged data detection method when executed by a processor.

[0071] The technical solution provided by the embodiment of the present invention, when performing forgery detection on the data to be detected, first obtains the data to be detected; then extracts the multidimensional data features of the data to be detected, including time series features, content features, and grammatical features, etc. For the time series features, it can be compared with the time series of the data to be detected in the time series of multiple data, so as to directly, efficiently and accurately determine whether the data to be detected is forged data; for the content features, it can be compared with the index content of the content to be detected and / or the session content in the session file, so as to directly, efficiently and accurately determine whether the data to be detected is forged data. For the grammatical features, it can be combined with the grammatical feature classification model to accurately determine whether the data to be detected is forged data. It can be seen that by combining the extraction of multidimensional data features with the grammatical feature classification model, data can be efficiently and accurately detected for forgery. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 A flow chart of a complete technical solution provided by an embodiment of the present invention;

[0073] Figure 2 A schematic diagram of multiple data features provided by an embodiment of the present invention;

[0074] Figure 3A flowchart of the training process of the grammatical feature classification model provided by an embodiment of the present invention;

[0075] Figure 4 A flowchart of a training process of a forged data identification model provided by an embodiment of the present invention;

[0076] Figure 5 A flow chart of a data forgery detection method provided by an embodiment of the present invention;

[0077] Figure 6 A flowchart of another data forgery detection method provided by an embodiment of the present invention;

[0078] Figure 7 A schematic diagram of the structure of a data forgery detection device provided by an embodiment of the present invention;

[0079] Figure 8 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0080] The present invention will be described in detail below through examples.

[0081] It should be noted that the information (including but not limited to device information, personal information, etc.) and related data (including but not limited to text data) involved in the present invention are all information authorized by all parties.

[0082] With the rapid development of network communication technology, data interaction has become increasingly frequent and important. However, in the process of data interaction, data may be forged or tampered with, which poses a serious threat to data security. Therefore, developing an efficient data forgery detection technology is of great significance for protecting data security and maintaining network order.

[0083] The technical solutions in the related technologies are still limited to the collection and fixation of data. Currently, there is no method that can detect and identify the authenticity of data. Therefore, there is an urgent need to provide an efficient and accurate data forgery detection method.

[0084] The present invention can efficiently and accurately detect data forgery by combining multiple data feature extraction methods and data forgery identification models. The multiple data features may include time series features, content features, and statistical features of the data. Among them, the content features include session features and index features; the statistical features include grammatical features. These data features will be described in detail in the following embodiments.

[0085] In addition, a feedback correction mechanism can be used to continuously optimize the data forgery recognition model. In practical applications, in order to improve the accuracy and efficiency of data forgery detection, multiple data forgery recognition models can be integrated. At the same time, the data forgery recognition model can be regularly updated to adapt to new forgery methods and changes, thereby improving the adaptability and robustness of the system.

[0086] The complete technical solution of the present invention will be described in detail below in conjunction with specific application scenarios. Figure 1 Shown is a flow chart of the complete technical solution of the present invention.

[0087] S110, data preprocessing. Specifically, before performing data forgery detection on the data, data preprocessing may be performed on the data. Specifically, it includes: collecting and preprocessing the data to be detected, removing irrelevant data, and retaining only useful data, that is, standardizing the data to be detected, and obtaining a standard data stream, so as to extract data features of the data to be detected in subsequent steps.

[0088] S120, extracting data features of the data to be detected. Specifically, after obtaining the standard data stream, multiple data features of the standard data stream can be extracted, such as Figure 2 As shown, these multiple data features include time series features, session features, index content features, statistical features (mainly including grammatical features, such as punctuation marks, the number of occurrences of idiomatic words, etc.) and features that the data has been directly tampered with. Extracting data features can assist in subsequent data forgery detection and identification.

[0089] S130, data forgery detection. Specifically, for time series features, session features, index content features, and features of data being directly tampered with, it is possible to directly detect whether the data is forged. For statistical features, machine learning algorithms, such as SVM (Support Vector Machine) classification models, random forest models, etc., can be used to classify statistical features (i.e., grammatical features) to assist decision-making in detecting real and forged message data.

[0090] The following will explain in detail how to detect forged data through time series features, session features, index content features, features of directly tampered data, and grammatical features.

[0091] 1. For time series features, multiple data in the database can be sorted in the order of the time when the data was generated. If the time of the data to be detected is tampered with, then the time series features of the data to be detected will not correspond to the time of the data to be detected stored in the database. For example, if the time of a certain data in the chat record table is tampered with, the time series of the database and the time of the data may not correspond. For example, the data was originally an earlier data, but it appears in the last data in the database. Therefore, by comparing the time series features of the data to be detected with the time stored in the database, if the two are inconsistent, it means that the time series of the data to be detected has been modified, and the data to be detected can be determined to be forged data.

[0092] 2. For the session features, a temporary session file corresponding to the data to be detected can be obtained; and the temporary session file can be parsed to obtain the session content included in the temporary session file; the session features of the data to be detected are compared with the session content obtained by parsing; if the content features of the data to be detected are inconsistent with the session content, it means that the content of the data to be detected has been tampered with, and therefore, the data to be detected can be determined to be forged data.

[0093] 3. Regarding index content features. In actual applications, some big data applications will create an index table for text messages. There may be a situation where only the display interface is tampered with, but the indexed text is not tampered with. Therefore, the index content corresponding to the data to be detected can be searched in the data index table stored in the local database; the index content features are compared with the found index content; if the content features of the data to be detected are inconsistent with the found index content, it means that the content of the data to be detected has been tampered with, so the data to be detected can be determined to be forged data.

[0094] 4. For features that indicate data has been directly tampered with, operation logs and recoverable data blocks may remain on the local server. In this case, it can be directly determined that the data has been tampered with.

[0095] 5. For grammatical features. The grammatical features can be input into a pre-trained grammatical feature classification model, such as an SVM (Support Vector Machine) classification model, a random forest model, etc. If the grammatical feature type output from the grammatical feature classification model is a tampered feature type, then it means that the grammar of the data to be detected has been tampered with. At this time, the data to be detected can be determined to be forged data.

[0096] Among them, Figure 3 As shown, the training process of the pre-trained grammatical feature classification model may include the following steps:

[0097] S131, obtaining grammatically correct training data as positive sample data; and obtaining grammatically incorrect training data as negative sample data.

[0098] S132, inputting the positive sample data and the negative sample data into the grammatical feature classification model to be trained, and training the grammatical feature classification model to be trained.

[0099] S133, when the accuracy of the feature type output from the grammatical feature classification model to be trained is greater than a preset threshold, determine to obtain a trained grammatical feature classification model.

[0100] Specifically, when training a grammatical feature classification model, a large number of training samples must first be collected, which are positive sample data consisting of grammatically correct training data and negative sample data consisting of grammatically incorrect training data. Then, the positive sample data and the negative sample data are input into the grammatical feature classification model to be trained, and the grammatical feature classification model is continuously trained. If the accuracy of the feature type output from the grammatical feature classification model to be trained is greater than a preset threshold, it means that the classification accuracy of the grammatical feature classification model is high. At this time, it is determined that the trained grammatical feature classification model is obtained.

[0101] S140, data forgery identification. Specifically, in practical applications, in order to improve the accuracy of data forgery detection and identification, after detecting forged data through S130, if the detection result is that it is not forged data, further identification can be performed through a forged data identification model. For example, for suspected forged data, deep learning algorithms such as convolutional neural networks and recurrent neural networks can be used for further identification to improve the accuracy of data forgery detection and identification.

[0102] Among them, Figure 4 As shown, the specific process of training the forged data recognition model may include the following steps:

[0103] S141, obtaining a real data sample as positive sample data; and obtaining a forged data sample as negative sample data.

[0104] S142, inputting the positive sample data and the negative sample data into the forged data recognition model to be trained, and training the forged data recognition model to be trained.

[0105] S143, when the accuracy of the forged data type output from the forged data identification model to be trained is greater than a preset threshold, determine to obtain a trained forged data identification model, wherein the forged data type includes forged data and not forged data.

[0106] Specifically, when training a forged data recognition model, a large number of training samples must first be collected, which are positive sample data consisting of real data and negative sample data consisting of forged data. Then, the positive sample data and the negative sample data are input into the forged data recognition model to be trained, and the forged data recognition model is continuously trained. If the accuracy of the forged type output from the forged data recognition model to be trained is greater than a preset threshold, it means that the recognition accuracy of the forged data recognition model is high. At this time, it is determined that the trained forged data recognition model is obtained. Among them, the preset threshold can be set according to the actual situation. It can be understood that the smaller the preset threshold is set, the higher the recognition accuracy of the forged data recognition model.

[0107] As can be seen from the above description, the technical solution provided by the embodiment of the present invention first pre-processes the data to be detected before forgery detection and identification of the data to be detected, eliminating the interference of useless information; then, extract the multi-dimensional data features of the pre-processed data, including time series features, session features, index content features and grammatical features, etc. For time series features, session features, and index content features, it is possible to directly, efficiently and accurately determine whether the data to be detected is forged data by comparing with the time series, temporary session content and data index table of the data to be detected. For grammatical features, it is possible to accurately determine whether the data to be detected is forged data in combination with a grammatical feature classification model. It can be seen that the technical solution provided by the embodiment of the present invention can efficiently and accurately detect forgery of data by combining the extraction of multi-dimensional data features with a grammatical feature classification model. Moreover, when the detection result is that the data is non-forged data, it can be further identified by a forged data identification model, further improving the accuracy of data forgery detection and identification.

[0108] After accurately detecting and identifying forged data, the grammatical feature classification model and the forged data identification model can be corrected and optimized based on the detection and identification results to improve the generalization ability of the grammatical feature classification model and the forged data identification model, thereby further improving the accuracy of data forgery detection and identification.

[0109] Moreover, in practical applications, in order to further improve the efficiency and accuracy of data forgery detection, the forged data identification model may include multiple forged data identification sub-models, so that multiple forged data identification sub-models can perform forgery detection on data at the same time, and multiple forged data identification sub-models respectively output the forgery type of the data.

[0110] In one implementation, if among the forgery types output by multiple forged data identification sub-models, there is a case where the data is forged data, it can be determined that the data is forged data.

[0111] Alternatively, in another embodiment, if among the forged types output by multiple forged data identification sub-models, the forged types in which the data is forged data account for a relatively large proportion, the data can be determined to be forged data. For example, the forged data identification model includes five forged data identification sub-models, namely forged data identification sub-model 1, forged data identification sub-model 2, forged data identification sub-model 3, forged data identification sub-model 4 and forged data identification sub-model 5. Among them, the forged types output by forged data identification sub-model 1, forged data identification sub-model 2, forged data identification sub-model 3 and forged data identification sub-model 4 are all: the data is forged data, and only the forged type output by forged data identification sub-model 5 is: the data is not forged data. It can be seen that the forged types in which the data is forged data account for 80%, and the forged types in which the data is not forged data account for 20%. Therefore, the forged types in which the data is forged data account for a relatively large proportion, and the data can be determined to be forged data.

[0112] In addition, in order to make the data forgery recognition model adaptable to new forgery methods and changes, that is, to further improve the recognition accuracy of forged data, the data forgery recognition model can be updated every preset time. Specifically, real data can be forged by a variety of different forgery methods to obtain forged data with different forgery methods, thereby improving the generalization ability of the data forgery recognition model.

[0113] After the overall technical solution of the present invention is described in detail, a data forgery detection method provided by an embodiment of the present invention will be described in detail below. The execution subject of the data forgery detection method may be a server capable of executing the data forgery detection method.

[0114] like Figure 5 As shown, a data forgery detection method provided by an embodiment of the present invention may include the following steps:

[0115] S510, obtaining data to be detected.

[0116] If a piece of data is to be detected as forged data, then the piece of data is the data to be detected. After obtaining the data to be detected, the data to be detected can be preprocessed to obtain a standard data stream. The specific implementation method has been described in the above embodiment and will not be repeated here.

[0117] S520: extracting data features of the data to be detected.

[0118] The data features include time series features, content features and grammatical features of the data to be detected.

[0119] Specifically, the data content of the data to be detected may include the generation time of the data to be detected, the specific content of the data to be detected, the idiomatic words and punctuation marks included in the data to be detected, and the number of idiomatic words and punctuation marks that match, etc. Therefore, after obtaining the data to be detected, multiple data features of the data to be detected can be extracted. These multiple data features include time series features, content features, and grammatical features, wherein the content features include conversation features and index content features; grammatical features include punctuation marks, the number of occurrences of idiomatic words, etc. Extracting data features can assist in the subsequent steps of data forgery detection.

[0120] S530, compare the time series feature with the time series of the data to be detected in the time series of multiple data to obtain a first comparison result; and compare the content feature with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result.

[0121] The plurality of data include data to be detected, and the first comparison result and the second comparison result both include: comparison consistency and comparison inconsistency.

[0122] In practical applications, the time series of multiple data can be stored in a database, which can be stored locally on the server as the execution subject, or obtained by the server as the execution subject from other servers, which is reasonable. The index content of the data to be detected and / or the session file corresponding to the data to be detected can also be stored locally on the server as the execution subject, or obtained by the server as the execution subject from other servers.

[0123] For the time series feature, it can be directly compared with the time series of the data to be detected in the time series of multiple data to obtain a first comparison result; and for the content feature, if the content feature is an index content feature, it can be directly compared with the index content of the data to be detected to obtain a second comparison result; if the content feature is a session content feature, it can be directly compared with the session content in the session file corresponding to the data to be detected to obtain a second comparison result.

[0124] In one embodiment, comparing the time series feature with the time series of the data to be detected in the time series of the multiple data to obtain a first comparison result may include the following steps, which are steps a1 to a4:

[0125] Step a1, obtaining a time series of multiple data including the data to be detected; and searching for a time series corresponding to the data to be detected in the time series of the multiple data.

[0126] Step a2: Compare the time series characteristics of the data to be detected with the time series corresponding to the found data to be detected.

[0127] Step a3: when the time series feature of the to-be-detected data is consistent with the event sequence corresponding to the found to-be-detected data, determining the first comparison result as comparison consistency.

[0128] Step a4: when the time series feature of the to-be-detected data is inconsistent with the event sequence corresponding to the found to-be-detected data, determining the first comparison result as comparison inconsistency.

[0129] For time series features, multiple data in the database can be sorted in the order of the time when the data is generated. If the time of the data to be detected is tampered with, then the time series features of the data to be detected will not correspond to the time of the data to be detected stored in the database. For example, if the time of a certain data in the chat record table is tampered with, it may happen that the time series of the database and the time of the data do not correspond. For example, the data was originally an earlier data, but it appears in the last data in the database. Therefore, by comparing the time series features of the data to be detected with the time stored in the database, if the two are inconsistent, the first comparison result is inconsistent comparison. If the two are consistent, the first comparison result is consistent comparison.

[0130] In one implementation, comparing the content feature with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result may include the following steps, namely, steps b1 to b4:

[0131] Step b1, obtaining a temporary session file corresponding to the data to be detected.

[0132] Step b2, parsing the temporary session file to obtain the session content included in the temporary session file.

[0133] Step b3, comparing the content features of the data to be detected with the conversation content.

[0134] Step b4: when the content feature of the data to be detected is consistent with the conversation content, determining the second comparison result as comparison consistency.

[0135] Step b5: when the content feature of the data to be detected is inconsistent with the conversation content, determining the second comparison result as a comparison inconsistency.

[0136] Specifically, for the session features, a temporary session file corresponding to the data to be detected can be obtained; and the temporary session file can be parsed to obtain the session content included in the temporary session file; the session features of the data to be detected are compared with the session content obtained by the analysis; if the content features of the data to be detected are inconsistent with the session content, the second comparison result is inconsistent with the comparison; if the content features of the data to be detected are consistent with the session content, the second comparison result is consistent with the comparison.

[0137] In another embodiment, comparing the content feature with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result may include the following steps:

[0138] Step c1, searching the target data index table for index content corresponding to the data to be detected; the target data index table stores index content corresponding to the data to be detected.

[0139] Step c2: comparing the content features with the found index content.

[0140] Step c3: when the content feature of the data to be detected is consistent with the searched index content, determining the second comparison result as a comparison consistency.

[0141] Step c4: when the content feature of the data to be detected is inconsistent with the searched index content, determining the second comparison result as inconsistent comparison.

[0142] Specifically, for index content features, in actual applications, some big data applications will create index tables for text messages, and there may be situations where only the display interface is tampered with, but the indexed text is not tampered with. Therefore, the index content corresponding to the data to be detected can be searched in the data index table that stores the index content corresponding to the data to be detected; the index content features are compared with the found index content; if the content features of the data to be detected are inconsistent with the found index content, the second comparison result is inconsistent; if the content features of the data to be detected are consistent with the found index content, the second comparison result is consistent.

[0143] S540, inputting the grammatical feature into a pre-trained grammatical feature classification model to obtain a feature type to which the grammatical feature belongs.

[0144] Among them, the feature types include untampered feature types and tampered feature types.

[0145] For grammatical features, the grammatical features can be input into a pre-trained grammatical feature classification model, such as an SVM (Support Vector Machine) classification model, a random forest model, etc., and the feature type to which the grammatical feature belongs can be output from the grammatical feature classification model. The feature type may be an untampered feature type or a tampered feature type.

[0146] It should be noted that the training process of the grammatical feature classification model has been described in the above embodiments and will not be repeated here.

[0147] S550: If the forged data condition is met, determine that the data to be detected is forged data. The forged data condition includes one or more of the following conditions: the first comparison result is a comparison inconsistency, the second comparison result is a comparison inconsistency, and the feature type is a tampering feature type.

[0148] Specifically, if the first comparison result is a comparison inconsistency, it means that the time series of the data to be detected is forged, and the data to be detected can be determined to be forged data. If the second comparison result is a comparison inconsistency, it means that the content of the data to be detected is forged, and the data to be detected can also be determined to be forged data. If the feature type of the grammatical feature is a tampered feature type, it means that the grammar of the data to be detected is forged, and the data to be detected can also be determined to be forged data. In other words, if any one or more of the three conditions are met, such as the first comparison result is a comparison inconsistency, the second comparison result is a comparison inconsistency, and the feature type is a tampered feature type, the data to be detected can be determined to be forged data.

[0149] The technical solution provided by the embodiment of the present invention, when performing forgery detection on the data to be detected, first obtains the data to be detected; then extracts the multidimensional data features of the data to be detected, including time series features, content features, and grammatical features, etc. For the time series features, it can be compared with the time series of the data to be detected in the time series of multiple data, so as to directly, efficiently and accurately determine whether the data to be detected is forged data; for the content features, it can be compared with the index content of the content to be detected and / or the session content in the session file, so as to directly, efficiently and accurately determine whether the data to be detected is forged data. For the grammatical features, it can be combined with the grammatical feature classification model to accurately determine whether the data to be detected is forged data. It can be seen that by combining the extraction of multidimensional data features with the grammatical feature classification model, data can be efficiently and accurately detected for forgery.

[0150] Based on the above embodiment, in one implementation, when the forged data condition is not met; Figure 6 As shown, the data forgery detection method may also include the following steps:

[0151] S560, inputting the data to be detected into a pre-trained forged data recognition model.

[0152] Among them, the forged data recognition model is trained by real data samples and forged data samples.

[0153] S570, identifying the data to be detected by using a forged data identification model to obtain the forgery type of the data to be detected.

[0154] The forgery type includes whether the data to be detected is forged data or whether the data to be detected is not forged data.

[0155] Specifically, in order to improve the accuracy of data forgery detection and identification, after the data to be detected is detected through S510 to S550, if the detection result is not forged data, the data to be detected can be further forged to improve the accuracy of data forgery detection. At this time, the data to be detected can be input into a pre-trained forged data identification model to be further identified by the forged data identification model. For example, deep learning algorithms such as convolutional neural networks and recurrent neural networks can be used for further identification to improve the accuracy of data forgery detection and identification.

[0156] As an implementation of the present invention, the training process of the forged data identification model may include the following steps, namely steps d1 to d4:

[0157] Step d1, obtaining real data as positive sample data, and obtaining forged data as negative sample data. The forged data is obtained by forging the real data through a variety of different forging methods.

[0158] Step d2: inputting the positive sample data and the negative sample data into the forged data recognition model to be trained, and training the forged data recognition model to be trained.

[0159] Step d3, when the accuracy of the forged data type output from the forged data recognition model to be trained is greater than a preset threshold, determine to obtain a trained forged data recognition model.

[0160] Specifically, when training a forged data recognition model, a large number of training samples must first be collected, which are positive sample data consisting of real data and negative sample data consisting of forged data. In the present invention, real data is forged by different forging methods to obtain negative samples, which helps the forged data recognition model to identify various types of forged data and helps to improve the recognition accuracy of the forged data recognition model. Among them, the forging methods can include multiple methods, for example, including deleting part of the real data, adding part of the real data, tampering with part of the real data, etc. The embodiment of the present invention does not specifically limit the forging methods.

[0161] After obtaining the positive sample data and the negative sample data, the positive sample data and the negative sample data are input into the forged data recognition model to be trained, and the forged data recognition model is continuously trained. If the accuracy of the forged type outputted from the forged data recognition model to be trained is greater than a preset threshold, it indicates that the recognition accuracy of the forged data recognition model is high. At this point, a forged data recognition model with a high recognition accuracy is obtained.

[0162] As an implementation manner of the embodiment of the present invention, the forged data identification model includes a plurality of forged data identification sub-models.

[0163] Specifically, in practical applications, in order to further improve the efficiency and accuracy of data forgery detection, the forged data identification model may include multiple forged data identification sub-models, so that multiple forged data identification sub-models can perform forgery detection on data at the same time, and multiple forged data identification sub-models respectively output the forgery type of the data.

[0164] At this time, in one implementation, S570, identifying the data to be detected by using the forged data identification model to obtain the forged type of the data to be detected, may include the following step e1:

[0165] Step e1, identifying the data to be detected by using multiple forged data identification sub-models respectively to obtain multiple forged types of the data to be detected, and determining that the data to be detected is forged data when a target forged type exists among the multiple forged types.

[0166] Among them, each forged data recognition sub-model outputs a forgery type; the target forgery type is that the data to be detected is forged data.

[0167] In this embodiment, if the data is forged data among the forged types output by the multiple forged data identification sub-models, the data can be determined to be forged data. It can be seen that through the multiple forged data identification sub-models, it can be further determined whether the data is forged data.

[0168] In another embodiment, S570, identifying the data to be detected by using the forged data identification model to obtain the forged type of the data to be detected may include the following step f1:

[0169] Step f1, identifying the data to be detected by using multiple forged data identification sub-models to obtain multiple forged types of the data to be detected, and determining that the data to be detected is forged data when the proportion of the target forged type in the multiple forged types is greater than the proportion of the non-target forged type.

[0170] Among them, the non-target forgery type is that the data to be detected is not forged data.

[0171] In this embodiment, if among the forged types output by multiple forged data identification sub-models, the forged types in which the data is forged data account for a relatively large proportion, the data can be determined to be forged data. For example, the forged data identification model includes 5 forged data identification sub-models, namely forged data identification sub-model 1, forged data identification sub-model 2, forged data identification sub-model 3, forged data identification sub-model 4 and forged data identification sub-model 5. Among them, the forged types output by forged data identification sub-model 1, forged data identification sub-model 2, forged data identification sub-model 3 and forged data identification sub-model 4 are all: the data is forged data, and only the forged type output by forged data identification sub-model 5 is: the data is not forged data. It can be seen that the forged types in which the data is forged data account for 80%, and the forged types in which the data is not forged data account for 20%. Therefore, the forged types in which the data is forged data account for a relatively large proportion, and the data can be determined to be forged data.

[0172] The present invention also provides a data forgery detection device, such as Figure 7 As shown, the device comprises:

[0173] The data acquisition module 710 is used to acquire the data to be detected;

[0174] A feature extraction module 720 is used to extract data features of the data to be detected; the data features include time series features, content features and grammatical features of the data to be detected;

[0175] The feature comparison module 730 is used to compare the time series feature with the time series of the data to be detected in the time series of the multiple data to obtain a first comparison result; and compare the content feature with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result; the multiple data include the data to be detected, and the first comparison result and the second comparison result both include: comparison consistency and comparison inconsistency;

[0176] The feature classification module 740 is used to input the grammatical feature into a pre-trained grammatical feature classification model to obtain the feature type to which the grammatical feature belongs; the feature type includes an untampered feature type and a tampered feature type;

[0177] The data detection module 750 is used to determine that the data to be detected is forged data when the data to be detected meets the forged data condition; the forged data condition includes one or more of the following conditions: the first comparison result is a comparison inconsistency, the second comparison result is a comparison inconsistency, and the feature type is a tampered feature type.

[0178] The technical solution provided by the embodiment of the present invention, when performing forgery detection on the data to be detected, first obtains the data to be detected; then extracts the multidimensional data features of the data to be detected, including time series features, content features, and grammatical features, etc. For the time series features, it can be compared with the time series of the data to be detected in the time series of multiple data, so as to directly, efficiently and accurately determine whether the data to be detected is forged data; for the content features, it can be compared with the index content of the content to be detected and / or the session content in the session file, so as to directly, efficiently and accurately determine whether the data to be detected is forged data. For the grammatical features, it can be combined with the grammatical feature classification model to accurately determine whether the data to be detected is forged data. It can be seen that by combining the extraction of multidimensional data features with the grammatical feature classification model, data can be efficiently and accurately detected for forgery.

[0179] Optionally, the device further comprises a forged data identification module, which is used to:

[0180] In the case where the forged data condition is not met, the data to be detected is input into a forged data recognition model obtained by pre-training; the forged data recognition model is obtained by training real data samples and forged data samples;

[0181] The data to be detected is identified by the forged data identification model to obtain the forgery type of the data to be detected, where the forgery type includes whether the data to be detected is forged data or whether the data to be detected is not forged data.

[0182] Optionally, the forged data identification model includes a plurality of forged data identification sub-models;

[0183] The forged data identification module is specifically used for:

[0184] The data to be detected are respectively identified by the multiple forged data identification sub-models to obtain multiple forged types of the data to be detected, and when a target forged type exists among the multiple forged types, the data to be detected is determined to be forged data; each of the forged data identification sub-models outputs a forged type; the target forged type is that the data to be detected is forged data;

[0185] or,

[0186] The data to be detected are respectively identified by the multiple forged data identification sub-models to obtain multiple forgery types of the data to be detected, and when the proportion of target forgery types in the multiple forgery types is greater than the proportion of non-target forgery types, it is determined that the data to be detected is forged data; the non-target forgery type means that the data to be detected is not forged data.

[0187] Optionally, the feature comparison module is specifically used to:

[0188] Acquire a time series of a plurality of data including the data to be detected; and search for a time series corresponding to the data to be detected in the time series of the plurality of data;

[0189] Comparing the time series characteristics of the data to be detected with the time series corresponding to the found data to be detected;

[0190] When the time series feature of the to-be-detected data is consistent with the event sequence corresponding to the found to-be-detected data, determining the first comparison result as comparison consistency;

[0191] When the time series feature of the to-be-detected data is inconsistent with the event sequence corresponding to the found to-be-detected data, it is determined that the first comparison result is a comparison inconsistency.

[0192] Optionally, the feature comparison module is specifically used to:

[0193] Obtaining a temporary session file corresponding to the data to be detected;

[0194] Parsing the temporary session file to obtain the session content included in the temporary session file;

[0195] Comparing the content characteristics of the data to be detected with the conversation content;

[0196] When the content feature of the data to be detected is consistent with the conversation content, determining the second comparison result as comparison consistency;

[0197] When the content feature of the data to be detected is inconsistent with the conversation content, the second comparison result is determined to be a comparison inconsistency.

[0198] Optionally, the feature comparison module is specifically used to:

[0199] Searching for index content corresponding to the data to be detected in a target data index table; the target data index table stores index content corresponding to the data to be detected;

[0200] Comparing the content characteristics with the found index content;

[0201] When the content feature of the data to be detected is consistent with the searched index content, determining the second comparison result as comparison consistency;

[0202] When the content feature of the to-be-detected data is inconsistent with the found index content, the second comparison result is determined to be inconsistent.

[0203] In a third aspect, an embodiment of the present invention further provides an electronic device, such as Figure 8 As shown, including:

[0204] at least one processor 801;

[0205] a memory 802 for storing the at least one processor executable instruction;

[0206] The at least one processor is configured to execute the instructions to implement the forged data detection method.

[0207] The technical solution provided by the embodiment of the present invention, when performing forgery detection on the data to be detected, first obtains the data to be detected; then extracts the multidimensional data features of the data to be detected, including time series features, content features, and grammatical features, etc. For the time series features, it can be compared with the time series of the data to be detected in the time series of multiple data, so as to directly, efficiently and accurately determine whether the data to be detected is forged data; for the content features, it can be compared with the index content of the content to be detected and / or the session content in the session file, so as to directly, efficiently and accurately determine whether the data to be detected is forged data. For the grammatical features, it can be combined with the grammatical feature classification model to accurately determine whether the data to be detected is forged data. It can be seen that by combining the extraction of multidimensional data features with the grammatical feature classification model, data can be efficiently and accurately detected for forgery.

[0208] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to execute the forged data detection method described above.

[0209] The technical solution provided by the embodiment of the present invention, when performing forgery detection on the data to be detected, first obtains the data to be detected; then extracts the multidimensional data features of the data to be detected, including time series features, content features, and grammatical features, etc. For the time series features, it can be compared with the time series of the data to be detected in the time series of multiple data, so as to directly, efficiently and accurately determine whether the data to be detected is forged data; for the content features, it can be compared with the index content of the content to be detected and / or the session content in the session file, so as to directly, efficiently and accurately determine whether the data to be detected is forged data. For the grammatical features, it can be combined with the grammatical feature classification model to accurately determine whether the data to be detected is forged data. It can be seen that by combining the extraction of multidimensional data features with the grammatical feature classification model, data can be efficiently and accurately detected for forgery.

[0210] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program, which implements the forged data detection method when executed by a processor.

[0211] The technical solution provided by the embodiment of the present invention, when performing forgery detection on the data to be detected, first obtains the data to be detected; then extracts the multidimensional data features of the data to be detected, including time series features, content features, and grammatical features, etc. For the time series features, it can be compared with the time series of the data to be detected in the time series of multiple data, so as to directly, efficiently and accurately determine whether the data to be detected is forged data; for the content features, it can be compared with the index content of the content to be detected and / or the session content in the session file, so as to directly, efficiently and accurately determine whether the data to be detected is forged data. For the grammatical features, it can be combined with the grammatical feature classification model to accurately determine whether the data to be detected is forged data. It can be seen that by combining the extraction of multidimensional data features with the grammatical feature classification model, data can be efficiently and accurately detected for forgery.

[0212] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention without departing from the principles and intent of the present invention.

Claims

1. A data forgery detection method, characterized in that: The method comprises: Obtain the data to be tested; Extracting data features of the data to be detected; the data features include time series features, content features and grammatical features of the data to be detected; Comparing the time series feature with the time series of the data to be detected in the time series of the plurality of data to obtain a first comparison result; and comparing the content feature with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result; the plurality of data include the data to be detected, and the first comparison result and the second comparison result both include: comparison consistency and comparison inconsistency; Inputting the grammatical feature into a pre-trained grammatical feature classification model to obtain a feature type to which the grammatical feature belongs; the feature type includes an untampered feature type and a tampered feature type; When a forged data condition is met, the data to be detected is determined to be forged data; the forged data condition includes one or more of the following conditions: the first comparison result is a comparison inconsistency, the second comparison result is a comparison inconsistency, and the feature type is a tampered feature type.

2. The method according to claim 1, characterized in that In the case where the forged data condition is not met; the method further comprises: Inputting the data to be detected into a pre-trained forged data recognition model; the forged data recognition model is trained by real data samples and forged data samples; The data to be detected is identified by the forged data identification model to obtain the forgery type of the data to be detected, where the forgery type includes whether the data to be detected is forged data or whether the data to be detected is not forged data.

3. The method according to claim 2, characterized in that The forged data identification model includes a plurality of forged data identification sub-models; The step of identifying the data to be detected by using the forged data identification model to obtain the forgery type of the data to be detected includes: The data to be detected are respectively identified by the multiple forged data identification sub-models to obtain multiple forged types of the data to be detected, and when a target forged type exists among the multiple forged types, the data to be detected is determined to be forged data; each of the forged data identification sub-models outputs a forged type, and the target forged type is: the data to be detected is forged data; or, The data to be detected are respectively identified by the multiple forged data identification sub-models to obtain multiple forgery types of the data to be detected, and when the proportion of target forgery types in the multiple forgery types is greater than the proportion of non-target forgery types, it is determined that the data to be detected is forged data; the non-target forgery type is: the data to be detected is not forged data.

4. The method according to any one of claims 1 to 3, characterized in that: The time series feature is compared with the time series of the data to be detected in the time series of the multiple data to obtain a first comparison result, including: Acquire a time series of a plurality of data including the data to be detected; and search for a time series corresponding to the data to be detected in the time series of the plurality of data; Comparing the time series characteristics of the data to be detected with the time series corresponding to the found data to be detected; When the time series feature of the to-be-detected data is consistent with the event sequence corresponding to the found to-be-detected data, determining the first comparison result as comparison consistency; When the time series feature of the to-be-detected data is inconsistent with the event sequence corresponding to the found to-be-detected data, it is determined that the first comparison result is a comparison inconsistency.

5. The method according to any one of claims 1 to 3, characterized in that: The step of comparing the content feature with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result includes: Obtaining a temporary session file corresponding to the data to be detected; Parsing the temporary session file to obtain the session content included in the temporary session file; Comparing the content characteristics of the data to be detected with the conversation content; When the content feature of the data to be detected is consistent with the conversation content, determining the second comparison result as comparison consistency; When the content feature of the data to be detected is inconsistent with the conversation content, the second comparison result is determined to be a comparison inconsistency.

6. The method according to any one of claims 1 to 3, characterized in that: The step of comparing the content feature with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result includes: Searching for index content corresponding to the data to be detected in a target data index table; the target data index table stores index content corresponding to the data to be detected; Comparing the content characteristics with the found index content; When the content feature of the data to be detected is consistent with the searched index content, determining the second comparison result as comparison consistency; When the content feature of the to-be-detected data is inconsistent with the found index content, the second comparison result is determined to be inconsistent.

7. A data forgery detection device, characterized in that: The device comprises: A data acquisition module, used for acquiring data to be detected; A feature extraction module, used to extract data features of the data to be detected; the data features include time series features, content features and grammatical features of the data to be detected; The feature comparison module is used to compare the time series feature with the time series of the data to be detected in the time series of the multiple data to obtain a first comparison result; and compare the content feature with the index content of the data to be detected and / or the session content in the session file corresponding to the data to be detected to obtain a second comparison result; the multiple data include the data to be detected, and the first comparison result and the second comparison result both include: comparison consistency and comparison inconsistency; A feature classification module, used for inputting the grammatical feature into a pre-trained grammatical feature classification model to obtain a feature type to which the grammatical feature belongs; the feature type includes an untampered feature type and a tampered feature type; A data detection module is used to determine that the data to be detected is forged data when the data to be detected meets a forged data condition; the forged data condition includes one or more of the following conditions: the first comparison result is a comparison inconsistency, the second comparison result is a comparison inconsistency, and the feature type is a tampered feature type.

8. An electronic device, characterized in that: include: at least one processor; a memory for storing the at least one processor-executable instruction; The at least one processor is configured to execute the instructions to implement the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images